Skill Openclaw

Give your OpenClaw agent the power to spend. Stablecoin payments, spending policies, and compliance — built-in.

Security Scan

The skill's code, declared requirements, and runtime instructions are coherent with a payments/spending skill; required credentials and binaries match the described functionality, but it persists API secrets to the local OpenClaw config and runs a long‑running local server — review and rotate keys before use.

Purpose & Capability

Name/description (OpenClaw payments, KYA, spending policies) match the files and runtime behavior. The skill exposes payment, balance, marketplace and attestation tools and requires ORIS_API_KEY, ORIS_API_SECRET, and ORIS_AGENT_ID which are exactly the credentials needed for a payments API.

Instruction Scope

SKILL.md and code instruct the agent to run a local MCP server (python -m oris_mcp.server) and a setup flow that registers the agent and writes credentials to ~/.openclaw/config.json. This is within the stated payment scope, but the skill explicitly persists the API key/secret to disk (OpenClaw config) and the MCP server holds the credentials in memory to sign requests — that persistence is expected for this skill but is a sensitive action users should be aware of.

Install Mechanism

No external arbitrary download URLs or extract/install from untrusted hosts are present. All necessary code is included in the package (Python and JS artifacts plus packaging metadata). The SKILL.md frontmatter contains an 'install' entry (kind: uv path: .) which is slightly unusual/ambiguous but not evidence of an external fetch. Overall install footprint appears local and self-contained.

Credentials

The skill requests only ORIS_API_KEY, ORIS_API_SECRET, and ORIS_AGENT_ID — these are appropriate and necessary for signing and identifying payments. No unrelated secrets are requested. Caveat: the API secret is written in cleartext to ~/.openclaw/config.json by the provided CLI code; storing long‑lived secrets on disk increases exposure risk and should be considered when authorizing the skill.

Persistence & Privilege

always: false and default autonomous invocation are set. The skill runs a local MCP server process (expected for exposing tools to the agent) and writes its own config under the 'oris' key of the shared OpenClaw config file; it does not modify other skills' config keys. No elevated 'always' privilege or evidence of modifying unrelated agent/system settings was found.

Assessment

This skill appears to implement the described payments and compliance features and asks only for the Oris API credentials it needs. Before installing: 1) Confirm you trust useoris.finance / Fluxa Ventures (the skill will use your API key/secret to move funds). 2) Be aware the setup writes your API key and secret into ~/.openclaw/config.json in plaintext — restrict file permissions, consider using short‑lived or restricted keys, and rotate them after testing. 3) The skill runs a local MCP server that will hold credentials in memory and accept tool calls from the agent; ensure only trusted agents/clients can talk to it and set conservative spending limits (default policy is $50/tx, $200/day). 4) The package depends on a Node CLI (setup) and Python server; verify dependencies (e.g., oris-sdk) and inspect the included package.json/pyproject if you need higher assurance. If you require more assurance, ask the maintainer for a signed release, a minimal install recipe, or run the setup in a restricted environment first.

Oris Payments for OpenClaw

Oris is payment infrastructure for autonomous AI agents. Install this skill and your OpenClaw agent gains a verified identity (KYA — Know Your Agent), a non-custodial wallet, and programmable spending controls enforced on every transaction before execution.

Setup

Get a free API key at useoris.finance, then run:

openclaw run oris setup

Setup takes about two minutes. It will:

1. Register your OpenClaw instance as a verified agent
2. Create a non-custodial ERC-4337 wallet on Base
3. Apply a default spending policy ($50 per transaction, $200 per day)

Your credentials are stored in your local OpenClaw config. They are used to sign authenticated requests to the Oris API (api.useoris.finance) when your agent performs payment operations.

What your agent can do

Send payments — USDC, USDT, or EURC on Base, Ethereum, Polygon, Arbitrum, Solana, Avalanche, BSC, Optimism, and Celo. Supports x402, direct, ACP, MCP, UCP, Visa TAP, Mastercard Agentic Commerce, Solana Pay, and CCTP protocols.

Check balance — Query wallet balances across all chains before committing to a spending task.

Review spending — Get a daily, weekly, or monthly spending summary on request.

Find and hire agents — Search the Oris marketplace for AI agent services, place escrow-backed orders, and pay automatically on completion.

Fund the wallet — On-ramp from USD or EUR via bank transfer or card. Off-ramp back to a bank account.

Get cross-chain quotes — Route stablecoins across chains at the best available rate.

Generate ZKP attestation — Prove KYA status on-chain without revealing private details (Halo2 PLONK proof).

Every payment goes through this pipeline

KYA check
→ Spending policy evaluation  (<10ms, Redis-cached)
→ Sanctions screening          (<100ms, OFAC + EU + UN lists)
→ On-chain execution

If any step fails, the payment is rejected — not delayed. The system is fail-closed. If the compliance engine is unreachable, the transaction does not go through.

Spending policy

The default policy is conservative. You can adjust it from the Oris dashboard or in your OpenClaw config:

{
  "oris": {
    "policy": {
      "max_per_transaction": 50,
      "max_daily": 200,
      "max_monthly": 2000,
      "allowed_chains": ["base", "polygon"]
    }
  }
}

Available tools

Tool	What it does
oris_pay	Send a stablecoin payment
oris_check_balance	Query wallet balances across chains
oris_get_spending	Spending summary (day / week / month)
oris_find_service	Search the Oris agent marketplace
oris_place_order	Buy a service from another agent
oris_approve_pending	Approve an escalated payment
oris_fiat_onramp	Fund wallet from fiat (USD/EUR)
oris_fiat_offramp	Withdraw to bank account
oris_exchange_rate	Fiat/stablecoin exchange rate
oris_cross_chain_quote	Cross-chain transfer quote and routing
oris_get_tier_info	KYA tier, limits, and current usage
oris_generate_attestation	ZKP proof of KYA status
oris_promotion_status	Tier upgrade eligibility and progress

Supported networks and assets

Chains: Base, Ethereum, Polygon, Arbitrum, Solana, Avalanche, BSC, Optimism, Celo Stablecoins: USDC, USDT, EURC Protocols: x402, direct, ACP, MCP, UCP, Visa TAP, Mastercard Agentic Commerce, Solana Pay, CCTP

Enterprise and compliance

Every transaction generates an immutable audit trail accessible via the Oris dashboard or API. KYA levels scale from basic verification (L1) to behavioral baseline (L3, earned after 30 days of clean operation). Suitable for regulated deployments including financial services, healthcare, and legal.

Support

• Docs: useoris.finance/docs
• Discord: discord.gg/oris — #openclaw channel
• GitHub: github.com/fluxaventures/oris
• Enterprise: [e-mail]

---

Oris is a Fluxa Ventures product. Licensed MIT.